You have a name. Before you design a logo, print a card or tell anyone, you need to know whether the domain is free, and usually not just the .com. You want to know about .io, .ai, .dev and whatever country code your customers live under. Checking them one at a time in a registrar's search box is slow, and the answer you get back is sometimes wrong in ways the page never admits.
This guide explains where availability data comes from, why the old WHOIS protocol produces false "available" results, what RDAP changed, and how to read a registration record once you find a name that is taken. The examples use the Toolz domain availability checker, which queries registries directly across up to 68 extensions in one search.
TL;DR: A domain is available when the registry that runs its TLD has no record of it. The reliable way to ask is RDAP (RFC 9083), which returns structured JSON and a plain 404 for an unregistered name. Several hundred TLDs, mostly country codes, still answer only over WHOIS on port 43, where "no match" is free text that differs per registry. The Domain Search tool checks RDAP first, falls back to WHOIS, and reports "unknown" with a reason instead of guessing. It is free, no signup, capped at 40 names and 240 lookups per search, and runs on a server because browsers cannot make these lookups.
What does "available" mean for a domain name?
A domain name is available when no one holds a registration for it at the registry that operates its top-level domain. Every TLD has exactly one registry. Verisign runs .com and .net, Public Interest Registry runs .org, and each country-code TLD has its own operator. Registrars such as Namecheap or Hostinger sell registrations, but the registry holds the authoritative list of what exists.
That distinction matters because it tells you which answer to trust. A registrar's search page is a front end that eventually asks the registry, but it may also show cached results, premium pricing from its own inventory, or suggestions designed to sell you something. A lookup that goes to the registry itself removes those layers.
Availability at the registry is also only the first question. A name can be unregistered and still not purchasable at the normal price, because it sits on a reserved list or a premium price list, and many country codes have eligibility rules about who may register. More on that below.
RDAP vs WHOIS: what is the difference?
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns registration data as JSON over HTTPS, with every field defined, and it signals a missing domain with an ordinary HTTP 404. WHOIS is a text protocol from the early internet, specified in RFC 3912, that sends a query over TCP port 43 and returns whatever text the registry chooses to print.
The JSON response format is defined in RFC 9083. The question of which RDAP server to ask for a given TLD is answered by a bootstrap file that IANA publishes under RFC 9224, available at data.iana.org/rdap/dns.json. ICANN requires RDAP from every generic TLD registry, so .com, .app, .xyz and the rest all have it. Country-code registries are not bound by ICANN contracts, and many of them still offer only WHOIS.
| Attribute | RDAP | WHOIS |
|---|---|---|
| Transport | HTTPS | Raw TCP, port 43 |
| Response format | JSON with a defined schema | Free text, different per registry |
| "Not registered" signal | HTTP 404 | A phrase such as "No match for" or "NOT FOUND", which varies |
| Server discovery | IANA bootstrap file (RFC 9224) | Per-TLD knowledge or an IANA referral |
| Required for gTLDs | Yes | No longer the primary service |
| Coverage of country codes | Partial | Most still offer it |
| Dates | Standard timestamps | Any local format the registry prefers |
| Machine readability | High | Low, needs a parser per registry |
For a person checking one name, this looks like plumbing. For accuracy it is the whole story, because the next section is about what happens when a program reads WHOIS text wrong.
Why do some domain checkers say "available" when the name is taken?
False "available" results almost always come from WHOIS parsing. A simple checker sends the query, looks for a phrase like "not found" in the response, and calls the domain free if it sees one. That approach fails in several ordinary situations:
- Rate limiting. A registry that thinks you are sending too many queries may answer with a refusal message. If the checker only looks for "found", a refusal that happens to contain "not found" reads as available.
- Negation. Some availability services answer "Available" or "Not Available". A substring match for "available" matches both.
- Echoed queries. Some registries print your query back before the result, so the domain name and the words "no data" can appear in the same response even for a registered name.
- Parent-zone answers. Asking about a third-level name can return the record for the second-level zone above it, which describes a different object.
- Dead servers. A bundled list of WHOIS hosts goes stale. A connection error is not evidence that a name is free.
The Toolz checker handles each of these explicitly. It reads availability responses with negation awareness, rejects records that describe a parent zone, strips echoed queries, and when a bundled WHOIS host no longer answers, it asks IANA which server serves that TLD today. Anything it still cannot read with confidence is reported as unknown, with the reason next to it. That third verdict is what makes the other two usable: when the tool shows green, the registry said so.
How to check many domain names at once
A bulk search crosses a list of names with a list of extensions and looks up every combination. Here is how the counting works on the bulk domain search tool, step by step.
- Type the names. Separate them with commas or new lines. Duplicates are dropped, and names are lowercased. Up to 40 names fit in one search.
- Pick the extensions. Presets cover common sets: Startup selects ten (com, net, org, io, co, ai, app, dev, xyz and me), Popular selects 38, and a Bangladesh preset covers the .bd second levels. You can also tick any of the 68 extensions individually.
- Watch the counter. The number of lookups is names times extensions, shown before you search.
- Run it. Results stream in as each registry answers, so fast registries show up first.
A worked example with real numbers:
| Names typed | Extensions | Lookups | Result |
|---|---|---|---|
acmecloud, acme-cloud |
Startup (10) | 2 x 10 = 20 | Runs |
acmecloud, acme-cloud |
Popular (38) | 2 x 38 = 76 | Runs |
acmecloud |
All 68 | 1 x 68 = 68 | Runs |
acmecloud, acmehq, getacme |
All 68 | 3 x 68 = 204 | Runs |
acmecloud, acmehq, getacme, tryacme |
All 68 | 4 x 68 = 272 | Refused: over the 240 cap |
acmecloud, AcmeCloud |
Startup (10) | 1 x 10 = 10 | Duplicate removed after lowercasing |
With no extension ticked, a bare name is checked as .com and a full domain like acmecloud.io is checked exactly as typed.
The 240-lookup cap exists because registries throttle sweeps. Firing a thousand queries at once does not produce a thousand answers; it produces a pile of unknowns from rate limits. Lookups are paced per registry server and back off when a server pushes back, and a longer shortlist is better split into batches. If a sweep comes back with several "rate-limited" unknowns, wait a minute and run those names again.
When you are done, filter to Available, Taken or Unknown and export as .txt, .csv or .json. The .txt export is one domain per line, which pastes straight into most registrars' bulk search boxes. The CSV includes the domain, TLD, status, method (RDAP or WHOIS), registrar, created and expiry dates, nameservers, the note and the time each lookup took.
How to read a taken domain's registration record
Opening a taken result shows what the registry holds about it: registrar and IANA registrar ID, creation, update and expiry dates, EPP status codes, nameservers, DNSSEC state and the registrar's abuse contact. For RDAP registries this comes straight from the JSON. For WHOIS registries it is parsed from text, and dates arrive in whatever format the registry prints, so an unparseable date is shown as the registry wrote it rather than as an error.
The status codes are the most useful part, and they come from the Extensible Provisioning Protocol. Their meanings are defined in RFC 5731, with the grace-period states added by RFC 3915.
| Status | What it means for you |
|---|---|
ok / active |
Registered, nothing pending. Not coming free soon. |
clientTransferProhibited |
Registrar lock against transfers. Normal on most domains. |
clientHold / serverHold |
Registered but not published in DNS. The site will not resolve, yet the name is still owned. |
redemptionPeriod |
Expired and deleted by the registrar; the previous owner can still restore it for a fee. |
pendingDelete |
Past redemption. The name is scheduled to drop and will become available shortly. |
pendingTransfer |
Moving between registrars right now. |
The expiry date tells you less than people hope. Most registrations renew automatically, and an expired generic domain usually passes through a grace period and a redemption period before it is released. A name showing pendingDelete is the only one close to dropping.
Can you check availability with DNS instead?
No. DNS tells you whether a name resolves, not whether it is registered. A domain can be registered with no DNS records at all, or sit on clientHold, and every DNS query will fail even though the name belongs to someone. Treating "no DNS records" as "available" is one of the most common mistakes in homemade checkers.
The tool offers DNS lookups as a separate, optional view: A, AAAA, NS, MX, TXT, CNAME and SOA records, queried through Cloudflare. They are useful once you know a domain is taken, for example to see whether it hosts email (MX records) or a live site (A records), but the availability verdict itself always comes from the registry. The same tool also shows the raw WHOIS text or raw RDAP JSON if you want to check the source yourself. For reference on what a 404 or 429 from an RDAP server means, the HTTP status codes guide covers each code.
Why is a domain "available" here but a registrar will not sell it?
There are three usual reasons, and none of them means the lookup was wrong.
Premium and reserved names. Registries keep lists of short or dictionary names that are unregistered but priced far above the standard fee, and some strings are reserved and not offered at all. The registry's registration record does not distinguish these from ordinary free names, so a registrar is the place that reveals the price.
Eligibility rules. Many country codes restrict who may register. Some require a local presence or a trustee, and some second-level zones are limited to specific kinds of organizations. .bd second levels such as edu.bd, gov.bd and mil.bd are examples; restricted categories often answer with a registry error rather than a yes or no, and the checker reports that as unknown because the registry did not say the name was free.
Timing. Someone may have registered the name between your lookup and your checkout. Registry data is live, but a minute is long enough.
Internationalized domain names and country-code zones
Names with non-ASCII letters are stored in DNS as Punycode, an ASCII encoding defined in RFC 3492. The German city name münchen becomes xn--mnchen-3ya, and that is the form registries index. The tool converts names to Punycode before looking them up, so you can type the Unicode form directly. Labels longer than 63 characters or domains longer than 253 characters are dropped as invalid rather than sent to a registry.
Country-code TLDs are where WHOIS still matters most. The checker keeps a per-registry table of WHOIS servers and the exact phrase each uses for "no such domain", and it covers the Bangladesh zone served by BTCL, including com.bd, net.bd, org.bd, info.bd, co.bd, tv.bd, ai.bd, edu.bd, ac.bd, sch.bd, id.bd, gov.bd and mil.bd. A few registries refuse public WHOIS queries entirely, .li and .qa among them, and those always come back as unknown.
Does a bulk domain checker send my names anywhere?
Yes, it has to, and it is worth being clear about why. Most Toolz tools are client-side and never send your data anywhere. Domain Search cannot work that way. RDAP needs cross-origin HTTPS requests to registry servers that do not allow browser access, and WHOIS needs a raw TCP connection on port 43, which no browser can open. So the names you enter are sent to the Toolz server, which performs the lookups and streams results back. The names are not stored.
A common worry with any domain search is front-running: someone watching searches and registering the names first. The practical defense is the same everywhere. Search, decide, and register quickly with a registrar you trust, rather than leaving a good name sitting in a spreadsheet for a week.
What are the limits and common errors?
| Situation | What you see | What to do |
|---|---|---|
| More than 240 combinations | An error asking you to trim the search | Fewer names or fewer extensions, then run a second batch |
| More than 40 names | Refused | Split the list |
| Registry throttled the sweep | Unknown, note mentions rate limiting | Re-run those names after a short wait |
| Registry refuses public WHOIS | Unknown with the refusal reason | Check at a registrar that sells that TLD |
| Restricted second-level zone | Unknown with a registry error | Read the zone's eligibility rules |
| Invalid characters or label too long | Name dropped before lookup | Use letters, digits and hyphens only |
| Daily allowance used | A count such as 10/10 today beside the form | Sign in to raise it, or wait for the reset |
The daily allowance applies per visitor and is shown next to the form. The base allowance is free, no signup.
Where the register links go
Available domains show the registry operator and its official registration information page from IANA, then prefilled searches at several registrars. Hostinger is listed first as a referral partner, because its annual hosting plans include a free domain for the first year; the link earns Toolz a commission at no extra cost to you. Other registrars are listed because no single registrar sells every TLD, especially among country codes.
Alternatives for checking domain availability
| Method | Good for | Weak spot |
|---|---|---|
| A registrar's search box | One name, with price shown | One TLD family at a time, suggestions mixed in |
whois on the command line |
Scripting, raw text | You parse each registry's wording yourself |
An RDAP client or curl against the bootstrap server |
Exact JSON for one name | Country codes without RDAP need WHOIS anyway |
| Toolz Domain Search | Many names across many TLDs, with unknowns labeled | Daily allowance, 240 lookups per search |
A quick RDAP check from a terminal looks like this, and a 404 status means the name is not registered at that registry:
curl -s -o /dev/null -w "%{http_code}\n" https://rdap.verisign.com/com/v1/domain/example.com
If you are building out the web side of a new project after picking the name, the IP subnet calculator guide covers addressing for the servers behind it, and the web tools hub lists the rest of the set. When you have a shortlist, run it through the multi-TLD availability checker in one pass and register the winner before someone else does.
